T1110 Brute Force — Detection & Response
Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.
Coverage at a glance
- Detections shipped
- 4
- Avg. verdict time
- < 5 min
- Data sources
- 3+
Threat context
How adversaries use T1110 Brute Force — Detection & Response
Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.
Password spraying (T1110.003) is the dominant attack pattern in modern cloud environments, where attackers try a small number of common passwords against a large number of accounts to avoid account lockout policies. Credential stuffing (T1110.004) uses leaked credential databases from prior breaches and is responsible for the majority of account takeover incidents against consumer-facing applications. Password cracking (T1110.002) targets offline hash dumps and is typically detected through T1003 precursor techniques.
Detections ManySignal ships
Ready-to-deploy detection rules
| Rule name | Severity | Data source |
|---|---|---|
| Password Spraying — Low-rate failures across many accounts from single IP Single IP attempts authentication against many accounts with few failures per account — classic spray pattern to evade lockout. | High | Okta / Entra ID |
| Credential Stuffing — High-volume failures with distinct username list Large number of failed authentications using a varied username set, indicative of automated credential stuffing from a breach list. | High | Application Logs |
| Rapid Auth Failure — More than 10 failures in 60 seconds for single account Single account targeted with rapid successive authentication attempts indicating targeted brute force. | Medium | Okta / Active Directory |
| Tor Exit Node Authentication Failure — Failed login from known Tor IP Authentication failure from a Tor exit node, commonly used to anonymise credential stuffing attacks. | High | Okta / Entra ID |
Related techniques and tactics
T1078 Valid Accounts — Detection & Response
ATT&CK Technique
T1566 Phishing — Detection & Response
ATT&CK Technique
T1059 Command and Scripting Interpreter — Detection & Response
ATT&CK Technique
T1053 Scheduled Task/Job — Detection & Response
ATT&CK Technique
T1548 Abuse Elevation Control Mechanism — Detection & Response
ATT&CK Technique
T1068 Exploitation for Privilege Escalation — Detection & Response
ATT&CK Technique
T1134 Access Token Manipulation — Detection & Response
ATT&CK Technique
T1098 Account Manipulation — Detection & Response
ATT&CK Technique
T1136 Create Account — Detection & Response
ATT&CK Technique
T1556 Modify Authentication Process — Detection & Response
ATT&CK Technique
T1621 Multi-Factor Authentication Request Generation — Detection & Response
ATT&CK Technique
T1539 Steal Web Session Cookie — Detection & Response
ATT&CK Technique
T1110 Brute Force — Detection & Response: frequently asked questions
How does ManySignal differentiate password spraying from legitimate multiple login failures?
ManySignal analyses the ratio of accounts targeted per source IP, the distribution of failures (many accounts, few failures each), and the time distribution of attempts. Legitimate failures cluster on a small number of accounts; spraying shows a characteristic long tail across many accounts.
Can ManySignal detect offline password cracking?
Offline cracking (T1110.002) leaves no authentication event telemetry. ManySignal detects the precursor technique: credential dump (T1003) on the endpoint, which provides the hashes that are subsequently cracked offline.
See the agentic SOC in action
Watch AI agents work a real alert queue — verdicts, evidence, and confidence scores included. In-house SOC or MDR, your call.